In the strictest sense, an app is a directory of configurations, and sometimes code. The directories and files inside have a particular naming convention and structure.
All configurations are in plain text and can be edited using your choice of text editor. Apps generally serve one or more of the following purposes:
- Acting as a container for searches, dashboards, and related configurations: This is what most users will do with apps. This is useful not only for logical grouping but also for limiting what configurations are applied and at what time. This kind of app usually does not affect other apps.
- Providing extra functionality: Many objects can be provided in an app for use by other apps. These include field extractions, lookups, external commands, saved searches, workflow actions, and even dashboards. These apps often have no user interface at all; instead, they add functionality to other apps.
- Configuring a Splunk installation for a specific purpose: In a distributed deployment, there are several different purposes that are served by the multiple installations of Splunk. The behavior of each installation is controlled by its configuration, and it is convenient to wrap those configurations into one or more apps. These apps completely change the behavior of a particular installation.